bitrat | 2774da0c82b3700d74725edf23bef248083b6df616c7b494c05d4b5aec3ef2f2

Analysis

max time kernel
145s
max time network
147s
platform
windows10_x64
resource
win10v20210408
submitted
05/10/2021, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
379838e742cfc29b58df5a63e68a1fef.exe
Size 3.0MB
Sample211005-ye866safaq
SHA256 2774da0c82b3700d74725edf23bef248083b6df616c7b494c05d4b5aec3ef2f2
MD5 379838e742cfc29b58df5a63e68a1fef
SHA1 a5c1f5a313a378d81a90d8010102c393040923c9
SHA512 306d9c3a4aa72e66c43e0ff1c96a698591b6c85d1cec13608810c664307caf7d6ed6f19c8d39f08a8bca06323bf8a2f970fa0f33ae84a4a7985adaa783d561fa
MD5 SHA1 SHA512

Score

10^/10

bitrat trojan

Malware Config

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

BitRAT Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3004-205-0x0000000000400000-0x00000000007CE000-memory.dmp	family_bitrat
behavioral2/memory/3004-206-0x000000000068A488-mapping.dmp	family_bitrat
behavioral2/memory/3004-216-0x0000000000400000-0x00000000007CE000-memory.dmp	family_bitrat

Nirsoft 5 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001ab2f-189.dat	Nirsoft
behavioral2/files/0x000b00000001ab2f-190.dat	Nirsoft
behavioral2/files/0x000b00000001ab2f-192.dat	Nirsoft
behavioral2/files/0x000b00000001ab2f-194.dat	Nirsoft
behavioral2/files/0x000b00000001ab2f-196.dat	Nirsoft

Executes dropped EXE 4 IoCs

pid	Process
420	AdvancedRun.exe
2840	AdvancedRun.exe
3344	AdvancedRun.exe
640	AdvancedRun.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3004	379838e742cfc29b58df5a63e68a1fef.exe
3004	379838e742cfc29b58df5a63e68a1fef.exe
3004	379838e742cfc29b58df5a63e68a1fef.exe
3004	379838e742cfc29b58df5a63e68a1fef.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
420	AdvancedRun.exe
420	AdvancedRun.exe
420	AdvancedRun.exe
420	AdvancedRun.exe
2840	AdvancedRun.exe
2840	AdvancedRun.exe
2840	AdvancedRun.exe
2840	AdvancedRun.exe
3344	AdvancedRun.exe
3344	AdvancedRun.exe
3344	AdvancedRun.exe
3344	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
856	379838e742cfc29b58df5a63e68a1fef.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	379838e742cfc29b58df5a63e68a1fef.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	420	AdvancedRun.exe
Token: SeImpersonatePrivilege	420	AdvancedRun.exe
Token: SeDebugPrivilege	2840	AdvancedRun.exe
Token: SeImpersonatePrivilege	2840	AdvancedRun.exe
Token: SeDebugPrivilege	3344	AdvancedRun.exe
Token: SeImpersonatePrivilege	3344	AdvancedRun.exe
Token: SeDebugPrivilege	640	AdvancedRun.exe
Token: SeImpersonatePrivilege	640	AdvancedRun.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeShutdownPrivilege	3004	379838e742cfc29b58df5a63e68a1fef.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	379838e742cfc29b58df5a63e68a1fef.exe
3004	379838e742cfc29b58df5a63e68a1fef.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1548	856	379838e742cfc29b58df5a63e68a1fef.exe	69
PID 856 wrote to memory of 1548	856	379838e742cfc29b58df5a63e68a1fef.exe	69
PID 856 wrote to memory of 1548	856	379838e742cfc29b58df5a63e68a1fef.exe	69
PID 856 wrote to memory of 2880	856	379838e742cfc29b58df5a63e68a1fef.exe	71
PID 856 wrote to memory of 2880	856	379838e742cfc29b58df5a63e68a1fef.exe	71
PID 856 wrote to memory of 2880	856	379838e742cfc29b58df5a63e68a1fef.exe	71
PID 856 wrote to memory of 3064	856	379838e742cfc29b58df5a63e68a1fef.exe	73
PID 856 wrote to memory of 3064	856	379838e742cfc29b58df5a63e68a1fef.exe	73
PID 856 wrote to memory of 3064	856	379838e742cfc29b58df5a63e68a1fef.exe	73
PID 856 wrote to memory of 420	856	379838e742cfc29b58df5a63e68a1fef.exe	82
PID 856 wrote to memory of 420	856	379838e742cfc29b58df5a63e68a1fef.exe	82
PID 856 wrote to memory of 420	856	379838e742cfc29b58df5a63e68a1fef.exe	82
PID 420 wrote to memory of 2840	420	AdvancedRun.exe	83
PID 420 wrote to memory of 2840	420	AdvancedRun.exe	83
PID 420 wrote to memory of 2840	420	AdvancedRun.exe	83
PID 856 wrote to memory of 3344	856	379838e742cfc29b58df5a63e68a1fef.exe	85
PID 856 wrote to memory of 3344	856	379838e742cfc29b58df5a63e68a1fef.exe	85
PID 856 wrote to memory of 3344	856	379838e742cfc29b58df5a63e68a1fef.exe	85
PID 3344 wrote to memory of 640	3344	AdvancedRun.exe	86
PID 3344 wrote to memory of 640	3344	AdvancedRun.exe	86
PID 3344 wrote to memory of 640	3344	AdvancedRun.exe	86
PID 856 wrote to memory of 3988	856	379838e742cfc29b58df5a63e68a1fef.exe	88
PID 856 wrote to memory of 3988	856	379838e742cfc29b58df5a63e68a1fef.exe	88
PID 856 wrote to memory of 3988	856	379838e742cfc29b58df5a63e68a1fef.exe	88
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90
PID 856 wrote to memory of 3004	856	379838e742cfc29b58df5a63e68a1fef.exe	90

C:\Users\Admin\AppData\Local\Temp\379838e742cfc29b58df5a63e68a1fef.exe
"C:\Users\Admin\AppData\Local\Temp\379838e742cfc29b58df5a63e68a1fef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 420
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 3344
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\379838e742cfc29b58df5a63e68a1fef.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\379838e742cfc29b58df5a63e68a1fef.exe
  C:\Users\Admin\AppData\Local\Temp\379838e742cfc29b58df5a63e68a1fef.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-197-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Download

memory/856-116-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/856-187-0x0000000007090000-0x0000000007266000-memory.dmp

Download

memory/856-114-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/856-185-0x0000000005E90000-0x0000000006081000-memory.dmp

Download

memory/856-198-0x0000000007770000-0x0000000007771000-memory.dmp

Download

memory/1548-129-0x0000000008CE0000-0x0000000008CE1000-memory.dmp

Download

memory/1548-126-0x0000000008430000-0x0000000008431000-memory.dmp

Download

memory/1548-121-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

Download

memory/1548-151-0x0000000007573000-0x0000000007574000-memory.dmp

Download

memory/1548-128-0x0000000008310000-0x0000000008311000-memory.dmp

Download

memory/1548-122-0x0000000007570000-0x0000000007571000-memory.dmp

Download

memory/1548-120-0x0000000007420000-0x0000000007421000-memory.dmp

Download

memory/1548-123-0x0000000007572000-0x0000000007573000-memory.dmp

Download

memory/1548-127-0x00000000084A0000-0x00000000084A1000-memory.dmp

Download

memory/1548-136-0x00000000098A0000-0x00000000098A1000-memory.dmp

Download

memory/1548-135-0x000000000A310000-0x000000000A311000-memory.dmp

Download

memory/1548-130-0x0000000008BB0000-0x0000000008BB1000-memory.dmp

Download

memory/1548-125-0x00000000081E0000-0x00000000081E1000-memory.dmp

Download

memory/1548-124-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

Download

memory/2880-167-0x0000000004F33000-0x0000000004F34000-memory.dmp

Download

memory/2880-154-0x0000000004F32000-0x0000000004F33000-memory.dmp

Download

memory/2880-153-0x0000000004F30000-0x0000000004F31000-memory.dmp

Download

memory/3004-205-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/3004-216-0x0000000000400000-0x00000000007CE000-memory.dmp

Download

memory/3064-186-0x00000000071C3000-0x00000000071C4000-memory.dmp

Download

memory/3064-169-0x00000000071C2000-0x00000000071C3000-memory.dmp

Download

memory/3064-168-0x00000000071C0000-0x00000000071C1000-memory.dmp

Download

memory/3988-213-0x0000000008530000-0x0000000008531000-memory.dmp

Download

memory/3988-214-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

Download

memory/3988-215-0x0000000006FC2000-0x0000000006FC3000-memory.dmp

Download

memory/3988-211-0x0000000008020000-0x0000000008021000-memory.dmp

Download

memory/3988-228-0x00000000097D0000-0x00000000097D1000-memory.dmp

Download

memory/3988-229-0x00000000071E0000-0x00000000071E1000-memory.dmp

Download

memory/3988-236-0x0000000006FC3000-0x0000000006FC4000-memory.dmp

Download